The Evolution of Data Center Security at the Enclosure Level

Transcription

1 The Evolution of Data Center Security at the Enclosure Level Daniel Adamus, B.S., MBA Director of Marketing and Product Management Great Lakes Case & Cabinet

2 The Evolution of Data Center Security at the Enclosure Level

3 The Traditional Role of the Enclosure Simple Protection for Equipment Basic Security for Equipment Little to No Internal Cable Management Flood Cooling or Hot / Cold Aisle Deployment

4 An Expanded Role Today for Today s Data Center Enclosure Facilitates Intelligent Power and Real Time DCIM Monitoring Expanded Internal and External Cable Management Expanded Data Center and Enclosure Security A Variety of Managed Cooling Solutions Integral part of the building infrastructure

5 Why has Security become more important? Recent U.S. Data Breaches have had significant impact on the Government, Bank, Retail and Corporate Sectors Source: Bloomberg and The Heritage Foundation:

6 Why has Security become more important? Target attack shows danger of remotely accessible HVAC systems By Jaikumar Vijayan Computerworld Feb 7, :52 AM PT Cloud security service provider Qualys said that its researchers have discovered that most of about 55,000 HVAC systems connected to the Internet over the past two years have flaws that can be easily exploited by hackers. In Target's case, hackers stole login credentials belonging to a company that provides it HVAC services and used that access to gain a foothold on the company's payment systems. HVAC systems connect to networks at various retail companies, government buildings and even hospitals, according to the security firm. HVAC vendors and other third parties often have remote access right to these systems for administrative and support purposes. Hackers can exploit these systems to gain access to enterprise networks and leapfrog onto other corporate systems, Qualys said. Source: Bloomberg and The Heritage Foundation:

7 Why has Security become more important? Source: IBM Security Systems This identification and exploitation of a point of vulnerability in a data center or IT system is now being referred to as the Bonnie and Clyde Syndrome. Just as Bonnie and Clyde targeted rural banks as the most vulnerable, those seeking to attack systems will look for low priority systems which can be penetrated horizontally as a means of gaining more direct access to penetrate the main data and to extract valuable information. Source: Jean-Paul Daemen, Uptime Devices

8 Why has Security become more important? Potential Threats Posed by State-Sponsored Cyberwarfare/Cyberterrorism (Russia/China/North Korea) Domestic Physical Terrorism Washington Navy Yard Attack by Former Contractor with a Stolen Card Key O Hare Airport Attack by Subcontractor with Access

9 Why has Security become more important? Growth of Colocation Data Centers Since the last financial downturn in 2008, there has been steady growth of colocation data centers. That trend is forecasted to continue on a rapid pace. Analysts predict that between now and 2017, the global colocation data center footprint will grow close to 75 percent. (451 Research April 2015) Source: As more and more organizations migrate their data centers from their own control to a shared space location, there have been increased efforts (both by tenants and colo providers) to provide greater peace of mind through the deployment of enhanced security measures throughout these data centers. For many considering a move to a colocation facility, security is often their main concern.

10 Why has Security become more important? Not Only From Outside; Threats Often Come from Internal Team Members: A 2011 Gabriel survey estimated that more than 60% of malicious security breaches are at the hands of insiders. Source: Digitus Biometrics Access Security Solutions

11 Why has Security become more important? The Costs of a Data Breach are Substantial In 2015, IBM sponsored the 10 th Annual Cost of Data Breach Study conducted by the Ponemon Institute. The average consolidated total cost of a single data breach is estimated at $3.8 million (up 23% from 2013) The cost for each lost or stolen record containing sensitive and confidential information is estimated to be $ per record Source: IBM

12 Why has Security become more important? The Threat of a Data Breach is Constant In a March 20, 2012 U.S. News and World Report article, a spokesman for the National Nuclear Security Administration (NNSA) said the Nuclear Security Enterprise, the computer systems of the agency in charge of America s nuclear weapons stockpile are under constant attack and experience up to 10 million security significant cyber security events each day. Of the security significant events, less than one hundredth of a percent can be categorized as successful attacks against the Nuclear Security Enterprise computing infrastructure. That still amounts to a maximum of 1,000 of these events each day, just at this agency alone! Source: U.S. News and World Report

13 Why has Security become more important? Threats Often Come from Internal Team Members: Source: Digitus Biometrics Access Security Solutions

14 Why has Security become more important? Threats Often Come from Internal Team Members: Source: Digitus Biometrics Access Security Solutions

15 Why has Security become more important? Threats Often Come from Internal Team Members: Source: Digitus Biometrics Access Security Solutions

16 Why Consider Security at the Enclosure Level? While many companies and organizations are studying security throughout the data center, the buck stops at the enclosure. Every system and networking component within the data center ends up or passes through the enclosure. In a data center of thousands of enclosures, the easiest place to penetrate security without detection can be a single enclosure.

17 Security at the Enclosure Level Enclosure manufacturers are well aware of the need for increased security. Many have been working to refine their products and to work with accessory supplier partners and third-party vendors to develop effective security solutions which are compatible and complimentary to any and all additional security measures within the data center space.

18 Enclosure Construction An enclosure as a security platform must be designed and manufactured to minimize the risk of a break-in This is often accomplished by design, engineering and manufacturing to tight tolerances, eliminating any gaps which might exist among external components. Doors, Sides and Top Panels are produced and assembled at the same time, designed to fit perfectly. Often times frames and components are produced off-shore, shipped separately and then are configured as needed. (Fit and finish parameters may be more loose in the design of these products to ensure assembly, lot-to-lot.)

19 Enclosure Construction Some examples: Fit and Finish is important in Enclosure Construction

20 Enclosure Construction Some examples: This Gap could allow the latch to be forced open with relative ease

21 Enclosure Construction Some examples: Gap on the hinge side of the door

22 Enclosure Construction Doors & Locks Retro-Fitting Older Enclosures to a Common Security Standard In many cases a data center may have legacy enclosures from many different manufacturers. They may be easily brought to a common security standard by the creation of aftermarket doors and/or side panels which provide the desired fit and level of security desired for all enclosures in the data center space.

23 Enclosure Construction Doors & Locks The door frame itself is an important security feature. If strong and well-seated it can be a deterrent to anyone who may try to force their way into the Enclosure. While some manufacturers design their enclosures to maximize the mesh area (to allow the most air flow possible) they may also compromise the integrity of the handle with regard to security. It is much easier to force open a lock mounted in mesh than a lock installed within the door frame itself.

24 A Variety of Handles Provide Multiple Methods and Layers for Added Security Basic Examples of Security Handles for Enclosures : Standard Locking Swing Handle 4 Digit Combination with Key 3 Digit Combination with Key Locking Swing Handle with Padlock

25 A Variety of Handles Provide Multiple Methods and Layers for Added Security Electromechanical Locks: Electromechanical locks are traditionally powered via 110, ethernet or by battery and use some type of key, faub or proximity card reader. They traditionally also include a key lock or other method of access as a back-up in case of power failure. These products are available from a number of suppliers and in a variety of price ranges, based on ease of operation, flexibility of software and the types of cards which may be used in conjunction with the system, as well as the ability of this type of lock to foldinto the security system of the data center, the building and/or the campus upon which the data center is located.

26 A Variety of Handles Provide Multiple Methods and Layers for Added Security Temporary Access Number / Transaction Authentication Number or TAN Locks: Use of a TAN Lock requires some type of programming device which is used for the first installation process. With this device all necessary data is transmitted to the handle to bring it online and into operation. The interface is with a simple plug between the handle and programming device. The TAN Lock is a centralized, tamper proof latching and locking system, for data centers and other security sensitive applications. After approving an opening event from your computer, an additional TAN (Transaction Authentication Number) code is required to open the lock. Individual TAN codes can be issued by the administrator for unlimited or specified access, restricted to a particular window-in-time. After configuration, the lock may be programmed and monitored remotely by the administrator. A single lock can handle a large number of users with specific TAN codes

27 A Variety of Handles Provide Multiple Methods and Layers for Added Security Biometric Locks: Biometric locks utilize a fingerprint, retina scan or facial recognition software to allow access. This particular biometric handle utilizes an algorithm created from seven points on a person s fingerprint to create an access signature. No personal information is captured as part of this system so it is fully HIPAA compliant. This particular system also senses body temperature and pulse so the lock must be accessed by a living person. It can also register a panic finger to let authorities know the enclosure was opened by someone in distress. The software associated with this lock is compatible with any other security or DCIM software. At this time it is the only lock system which can provide an undisputable audit trail.

28 A Variety of Handles Provide Multiple Methods and Layers for Added Security Biometric Locks: Biometric locks may manage a single enclosure in a remote location or thousands of enclosures in a data center through a bus system which controls access at each door. They can also work in conjunction with keyed locks or card readers for added layers or security. The hardware to support the system has evolved dramatically in the last three years; what began as a 1RMU rack-mounted controller has shrunk, first to a zero-u component and today, the latest version is just 4 inches in length and can be installed anywhere in the enclosure.

29 A Variety of Handles Provide Multiple Methods and Layers for Added Security Biometric Locks: One of the few drawbacks with this level of security is the cost associated with biometric handles. An economical deployment throughout a data center is often provided by the installation of a biometric access handle on the front of each enclosure and a complimentary electromechanical handle on the rear door. A bus access control system saves cost by eliminating the need for a controller, network point and power supply at each cabinet. A sophisticated bus architecture system distributes fail-safe signals and electrical power from a single controller up to 64 cabinet door locks. The bus system also offers multiple options for authentication either at the cabinet or at the end of a row of cabinets.

30 Use of Color to Denote Access The use of color can provide a sense of identity within a colocation environment with unique, corporate or custom colors while at the same time identifying levels of access for those monitoring activity within the data center space. Customer Supplied Photos

31 Monitoring Considerations Within the Enclosure Remote Physical Monitoring (RPM) Devices With capabilities which rival any CPU, these rack mounted devices are designed to collect, process and report information on a number of conditions within the enclosure, to include, temperature, water, humidity, and air flow. With the proper sensors, these devices can also detect motion near or within the enclosure, whether a door has been accessed, if a side panel has been removed or even if either was tampered with.

32 Monitoring Considerations Within the Enclosure Remote Physical Monitoring (RPM) Devices These devices are designed to be daisy-chained so that a single unit may collect information and monitor a number of enclosures at any time. These products are traditionally vendor-neutral so they may work with sensors from a number of manufacturers and so they may be able to report data through any type of Data Center Infrastructure Management (DCIM) system or software.

33 Monitoring Considerations Within the Enclosure Power Distribution Units (PDUs) Monitored IP Addressable Remote Shutdown Event Notification Most security enclosure platforms allow for the mounting of multiple PDUs in the rear of the enclosure. Monitored PDU While designed to monitor a number of variables related to power at the outlet level, many intelligent PDUs have additional capacity for event monitoring and the reporting of anything which may be considered a threat to the enclosure in the same manner as an RPM.

34 Power Considerations Many traditional PDUs often utilize physical wire construction which can generate additional heat in the rear of the enclosure Some utilize metal housings resulting in hot touch points Modular Construction allows for an endless mix of receptacle configurations Solid State Construction and aluminum housings help to minimize residual heat generated by the PDU

35 Additional Physical Security Around the Enclosure Especially in a Colocation Environment, a customer may wish to have additional security in the form of a surround, cage or privacy panel system to define their individual space and to further restrict access to their enclosures.

36 Customer Supplied Photo This privacy panel system is designed to be modular. The individual panels can be designed to accommodate any number of enclosures in a variety of configurations, based on the needs of each colocation customer.

37 Additional Physical Security Around the Enclosure Cage Systems Source: This ceiling grid solution is available in a 4ˈx 4ˈ grid and 2ˈx 4ˈ grid for light-fixture drop-in. It has the strength and reinforcement to support the weight and intricacies of the overhead cable and utility distribution required in a data center. It has the aesthetic appeal of the drop ceiling, but in a single construction. Customer Supplied Photo In this case, customized privacy panels were designed and constructed to be secured to the ceiling grid system to prevent any incursion into the customer s caged space within the colocation data center.

38 Covering the Basics: Providing Protection, Often on Multiple Levels Customer Supplied Photos Privacy panel posts are locked to the raised floor and assembly can only be accomplished from the inside.

39 Covering the Basics: Providing Protection Often on Multiple Levels Door shown from the outside. Door can also accept a number of thirdparty security options. Privacy door from the inside, showing the stiffeners and the latch to prevent personnel from being locked-in. Customer Supplied Photo

40 Covering the Basics: Providing Protection Often on Multiple Levels Customer Supplied Photo Panels and extensions are easily assembled, with standard hardware. Extension panels allow for adjustment of height to meet any changes in room design within the data center complex. Panels for this system are available in three heights, 8, 9 and 14 feet. Custom heights are also available. Panels may only be accessed from inside the system

41 Additional Physical Security Around the Enclosure Containment as a Security Mechanism Containment (the isolation and concentration of conditioned air or heated exhaust) is a growing trend in data center efficiency. Containment strives to deliver the most effective amount of conditioned air possible at the most efficient cubic feet per minute (CFM) to the equipment mounted within the enclosure and/or to extract the heated exhaust from the rear of the enclosure, while eliminating bypass airflow and hot air recirculation. It may also be possible in the future to add additional security measures to containment pods not only to ensure energy efficiency but to also restrict unauthorized access to those enclosures deployed in each pod.

42 Expanded Options for Security Modular Space Modular or Containerized Data Centers Easy to Deploy in a variety of sizes Based on ISO shipping Containers Custom construction for assembly on-site Easy to Customize for operations (data center whitespace in a box ) Many organizations treat modular data centers as equipment and not as buildings, making it easier to expand a data center without all the effort, approval procedures and organizational processes required of brick & mortar expansions. Instead it can be leased or part of a lease-to-own program which shows up on a budget as a line item expense rather than a capital purchase.

43 Expanded Options for Security Modular Space Whether on-site or in a highly controlled environment, modular or containerized data centers can offer an immediate plug & play solution to supplement an existing data center, provide DRC support or even provide a greenfield solution. Any or all of the options for enclosures discussed previously may also be deployed within the modular space for additional layers of security beyond that provided by restricted access to the module.

44 Future-Proofing In any data center deployment it is important to consider the best practice of selecting a single enclosure platform which, as technologies and equipment evolve, will allow you to utilize a number of accessories and techniques when and where needed throughout the lifespan of your data center.

45 Enclosure Security: A Continuous Improvement Process Once a decision has been made to deploy security at the enclosure level, it is not a one-and-done effort. It is a Continuous Improvement Process requiring ongoing upgrades as firmware and software updates are available. It also requires constant diligence to ensure that the security evolves to keep pace with those who will strive to breach it.

46